Medium — DOP-C02 Practice Quiz

Question 1

A company uses AWS Certificate Manager (ACM) to issue public TLS certificates for several externally imported certificates that ACM cannot auto-renew (they were imported from a third-party CA). The security team was recently caught off guard when one imported certificate expired, causing a production outage. They need an automated, low-maintenance solution that proactively alerts the operations team at least 30 days before ANY imported certificate expires, across all accounts in the organization. Which approach BEST meets this requirement?

Accepted Answer

Enable the AWS Config managed rule acm-certificate-expiration-check across the organization, and configure a conformance pack with EventBridge to notify an SNS topic when a certificate is flagged noncompliant.

Answer

Create a Lambda function scheduled with EventBridge that calls acm:ListCertificates daily and publishes to SNS, deploying it manually in every account.

Answer

Rely on the ACM.expiryEventsDaysBeforeExpiry AWS Health event, which ACM automatically emits for imported certificates, and route it to SNS via EventBridge.

Answer

Enable Security Hub and use the AWS Foundational Security Best Practices control for ACM, which suppresses findings until a certificate is within 30 days of expiry.

Question 2

A company runs a stateless web application on EC2 instances behind an Application Load Balancer (ALB) spread across three Availability Zones. An Auto Scaling group maintains 3 instances per AZ. During a recent single-AZ impairment, monitoring showed that clients connected through the affected AZ received elevated latency and some 5xx errors even though healthy instances existed in the other two AZs. The DevOps team wants to ensure that a single-AZ failure does not degrade the user experience, with minimal ongoing management. Which action BEST addresses this requirement?

Accepted Answer

Confirm cross-zone load balancing is enabled on the ALB so requests are distributed evenly to healthy targets in all AZs regardless of which AZ received the request.

Answer

Enable ALB health checks with a lower unhealthy threshold and rely on the Auto Scaling group to replace failed instances in the impaired AZ.

Answer

Configure Route 53 latency-based routing with health checks pointing to per-AZ ALB nodes so traffic avoids the impaired AZ.

Answer

Increase the Auto Scaling group desired capacity and use a target tracking policy on ALB request count to add capacity when an AZ fails.

Question 3

A media streaming company runs a stateful session service on an EC2 Auto Scaling group behind a Network Load Balancer. During scale-in events, users report abruptly dropped streams because instances terminate while active sessions are still in progress. Each session can last up to 8 minutes and the application can persist session state to DynamoDB if given time. The DevOps team must ensure that instances chosen for termination complete in-flight sessions before shutting down, without changing the streaming protocol. What is the MOST appropriate way to achieve this?

Accepted Answer

Add an Auto Scaling lifecycle hook for the terminating state that pauses the instance in Terminating:Wait, and use a script on the instance to drain sessions and call CompleteLifecycleAction before the heartbeat timeout expires.

Answer

Increase the NLB deregistration delay (connection draining) to 600 seconds so sessions finish before the instance is removed from the target group.

Answer

Enable instance scale-in protection on all instances in the Auto Scaling group so that no instance with active sessions is ever terminated.

Answer

Configure a target tracking scaling policy with a longer cooldown period to delay scale-in until sessions naturally complete.

Question 4

A media company runs a stateless web tier on an EC2 Auto Scaling group behind an ALB. During flash-sale events, traffic ramps sharply then drops in irregular waves. The team currently uses simple scaling policies with CloudWatch alarms on average CPU, plus a 300-second cooldown period. They observe that the group repeatedly scales out and scales in within short intervals (flapping), causing instances to churn and users to hit brief connection errors while capacity settles. The team wants scaling to respond quickly to sustained demand while avoiding rapid oscillation, with minimal manual tuning of thresholds. Which change best meets these requirements?

Accepted Answer

Replace the simple scaling policies with a target tracking scaling policy on average CPU utilization, allowing Auto Scaling to compute the required capacity and manage the scaling thresholds automatically.

Answer

Increase the cooldown period to 1800 seconds so the group cannot scale in or out more than once every 30 minutes during the event.

Answer

Switch to scheduled scaling that sets a fixed desired capacity for the duration of every flash-sale window based on the previous event's peak.

Answer

Add a second simple scaling policy on network throughput and lower the CPU alarm threshold so the group reacts faster to traffic spikes.

Question 5

A platform team maintains a large CDK application (TypeScript) composed of dozens of stacks authored by multiple product teams. Governance requires that every S3 bucket in every stack must have server-side encryption enabled and every resource must carry a 'CostCenter' tag. The team wants to enforce these rules automatically at synthesis time so that non-compliant stacks fail the build, without asking each product team to modify their construct code. Which approach best meets these requirements?

Accepted Answer

Implement a CDK Aspect that visits every construct in the app, adds the required tags, and raises annotation errors when a bucket lacks encryption, then apply it via Aspects.of(app).add(...).

Answer

Enable CloudFormation drift detection on all deployed stacks and configure a nightly EventBridge rule to alert when buckets are found unencrypted or untagged.

Answer

Create an AWS Config conformance pack with managed rules for S3 encryption and required tags, deployed across the accounts via a StackSet.

Answer

Add a Service Control Policy that denies s3:CreateBucket unless encryption and the CostCenter tag are specified in the request.

Question 6

A DevOps team uses AWS CDK to define a multi-tier web application (VPC, ECS cluster, RDS database, and application services). They need to deploy this identical application to three separate AWS accounts (dev, staging, prod) within their organization. Each account must have its own isolated set of resources, and the team wants a single CDK codebase where the environment-specific account IDs and region are supplied at synth time, producing separate CloudFormation templates per environment. Which CDK approach best satisfies these requirements while keeping the code maintainable?

Accepted Answer

Define a reusable Stack subclass (or a Stage containing the stacks) and instantiate it once per environment in the CDK app, passing each environment's account and region via the stack/stage 'env' property.

Answer

Create a single CloudFormation StackSet from the CDK synthesized template and let StackSets fan the deployment out to all three accounts automatically.

Answer

Use CDK context lookups with cdk.context.json to hardcode all three account IDs into one stack, then deploy that one stack three times with --force.

Answer

Define one stack with no explicit 'env' property so it becomes environment-agnostic, then rely on the CLI credentials of each account to place resources correctly at deploy time.

Question 7

A team uses CDK Pipelines (the CodePipeline construct in the aws-cdk-lib/pipelines module) to deploy a multi-stage application. Developers add a new deployment stage to the pipeline definition in code and merge to the main branch. When the existing pipeline runs, they expect the new stage to appear, but they are concerned about how the pipeline picks up structural changes to its own definition. Which behavior of CDK Pipelines correctly explains how the new stage becomes part of the running pipeline?

Accepted Answer

The pipeline includes a self-mutation step that runs 'cdk deploy' on the pipeline stack itself early in execution, updating the pipeline (adding the new stage) before the application stages run.

Answer

The new stage is only added after an engineer manually runs 'cdk deploy' from a workstation; CDK Pipelines cannot modify its own structure during execution.

Answer

CodePipeline automatically detects the source change and re-synthesizes the pipeline on every action, so no dedicated mutation step is required.

Answer

The new stage is applied only on the next pipeline run after the current one completes, because CloudFormation cannot update a stack while its pipeline is executing.

Question 8

A DevOps team manages a production CloudFormation stack that deploys an application tier. They need to migrate an existing manually-created DynamoDB table into this stack so it becomes CloudFormation-managed, without any downtime or data loss. The table receives constant read/write traffic. Which approach correctly brings the table under management while minimizing risk?

Accepted Answer

Add the DynamoDB table resource to the template with a DeletionPolicy of Retain, then use a resource import operation (import change set) that maps the existing table's physical ID to the new logical resource, and review the change set before executing.

Answer

Delete the existing table, add the resource to the template, and redeploy the stack so CloudFormation recreates the table with the same name.

Answer

Add the table to the template and run a standard stack update; CloudFormation will automatically detect the existing physical resource by name and adopt it.

Answer

Enable drift detection on the stack, which will import any out-of-band resources it discovers into the stack's managed resource set.

Question 9

A DevOps team manages a production RDS database and its surrounding networking through a single CloudFormation stack deployed via a CodePipeline. During a routine template update that modifies the DB instance's DBInstanceIdentifier property, the team wants an automated safeguard in the pipeline that halts the deployment BEFORE any resource is replaced, so an engineer can review whether the change would destroy the existing database. Which approach best meets this requirement?

Accepted Answer

Add a stage that creates a CloudFormation change set with the CREATE_CHANGE_SET action, inspect the change set's 'Replacement' field for resources, and gate progression on a manual approval before executing the change set.

Answer

Enable termination protection on the stack so CloudFormation blocks any update that would replace a resource until an administrator disables it.

Answer

Attach a stack policy that denies Update:Replace on the RDS resource, causing the pipeline deployment to pause and prompt for approval when a replacement is attempted.

Answer

Run CloudFormation drift detection at the start of the deploy stage and fail the pipeline if the DB instance shows drift before applying the update.

Question 10

A team manages an S3 bucket, an IAM role, and a DynamoDB table through a single CloudFormation stack. An engineer, bypassing the pipeline, manually edited the S3 bucket policy and added a new lifecycle rule directly in the console during an incident. The next scheduled pipeline run deploys an unrelated change (adding a CloudWatch alarm) via a change set. The team wants to ensure the manual changes are reconciled to match the template AND wants ongoing visibility when future out-of-band changes occur, without deleting or recreating any resources. Which approach best meets these requirements?

Accepted Answer

Run CloudFormation drift detection on the stack to identify the divergence, then perform a normal stack update from the template so CloudFormation resets the drifted properties to the template-defined values; schedule periodic drift detection with EventBridge notifications for ongoing visibility.

Answer

Delete the stack with a Retain deletion policy on all resources, then re-import the resources into a fresh stack to guarantee the template and live state are identical.

Answer

Enable termination protection on the stack, which prevents any future manual modifications to the managed resources and automatically reverts unauthorized changes.

Answer

Add a stack policy that denies all Update actions on the S3 bucket, then rely on the next change set to overwrite the manual changes when the alarm is added.

Question 11

A DevOps team deploys a fleet of EC2 instances using a CloudFormation template. They want the instances to install packages, write configuration files, and start services automatically at launch, with the ability to update this configuration by simply updating the CloudFormation stack. They also want a clean signal to CloudFormation indicating whether the bootstrap configuration succeeded, so a failed configuration causes the stack update to roll back. Which approach best meets these requirements using native CloudFormation capabilities?

Accepted Answer

Define the configuration in the AWS::CloudFormation::Init metadata on the instance resource, run cfn-init in the UserData to apply it, and use cfn-signal with a CreationPolicy/UpdatePolicy so CloudFormation waits for and evaluates the success signal.

Answer

Embed all package installs and file writes as a bash script in the UserData block, and rely on the instance reaching the 'running' state as the success indicator for CloudFormation.

Answer

Store the configuration commands in an SSM Parameter Store hierarchy and use a Lambda-backed custom resource to SSH into each instance and apply the changes during stack updates.

Answer

Bake all configuration into a golden AMI and reference the AMI ID in the template, updating the AMI ID parameter whenever configuration changes are required.

Question 12

A DevOps team uses AWS CDK (v2) to deploy an application consisting of a parent stack with several nested stacks. Each nested stack references Lambda functions bundled from local source code as assets. The team runs 'cdk deploy' targeting a new region (eu-west-1) for the first time, but the deployment fails immediately with an error stating that the assets cannot be published because the environment is not bootstrapped. The same application deploys successfully in us-east-1. What is the correct way to resolve this while following AWS best practices for multi-region CDK deployments?

Accepted Answer

Run 'cdk bootstrap aws://ACCOUNT-ID/eu-west-1' to provision the CDKToolkit stack (including the asset S3 bucket and ECR repository) in the target region before deploying.

Answer

Manually create an S3 bucket in eu-west-1 named 'cdk-assets' and set the CDK_DEFAULT_BUCKET environment variable to point CDK at it.

Answer

Add a 'crossRegionReferences: true' property to the parent stack so CDK automatically copies assets from the us-east-1 bootstrap bucket to eu-west-1 at deploy time.

Answer

Change the nested stacks to inline the Lambda code using 'lambda.Code.fromInline' so that no asset publishing or bootstrapping is required in the new region.

Question 13

A DevOps team maintains a single CloudFormation template used to deploy an application across us-east-1, eu-west-1, and ap-southeast-2. The template launches EC2 instances that must use a region-specific, hardened AMI ID owned by the security team. The AMI IDs are updated roughly once per quarter through a separate golden-AMI pipeline. Deployments are triggered via a CodePipeline that runs the same template in all three regions. The team wants the correct AMI to be selected automatically per region at deploy time, without editing the template body and without manually passing AMI IDs as parameters on each run. Which approach best meets these requirements?

Accepted Answer

Store each region's latest hardened AMI ID in a Systems Manager Parameter Store parameter (same name per region) and reference it in the template using an SSM parameter type (AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>) so each stack resolves the value at deploy time.

Answer

Define a CloudFormation Mappings section that hardcodes the AMI ID for each region and use Fn::FindInMap with AWS::Region to select the value.

Answer

Pass the AMI ID as a CloudFormation parameter and have the CodePipeline deploy action supply the value from a variable configured per region in the pipeline.

Answer

Use a Lambda-backed custom resource that calls the EC2 DescribeImages API during every stack update to look up the newest AMI matching a name filter.

Question 14

A DevOps team manages a production VPC, subnets, and an RDS instance that were all created manually through the AWS console over two years ago. Management now requires all infrastructure to be managed as code using CloudFormation so that changes go through the change-set review process. The team must bring these existing, live resources under CloudFormation management WITHOUT deleting them or causing any downtime to the running RDS database. Which approach meets these requirements?

Accepted Answer

Author a CloudFormation template that describes the existing resources, then use the resource import operation (create change set with import) to bring the resources into a new or existing stack, matching each logical resource to its physical resource identifier.

Answer

Delete the manually created resources and recreate them by deploying a new CloudFormation stack that defines the VPC, subnets, and RDS instance from scratch.

Answer

Enable drift detection on an empty stack, which will automatically detect the orphaned resources and adopt them into the stack once remediation is applied.

Answer

Add a DeletionPolicy of Retain to a new template and deploy it; CloudFormation will recognize the identically named existing resources and take over their management.

Question 15

A DevOps team manages a shared networking stack and multiple application stacks in the same account and region using AWS CDK. Application stacks need to reference the VPC ID and subnet IDs produced by the networking stack. Currently they use CloudFormation cross-stack exports (Fn::ImportValue). The team frequently needs to modify the networking stack's subnet configuration, but CloudFormation blocks these updates because the values are exported and consumed by other stacks. They want a decoupling approach that still keeps everything defined as code and allows the networking stack to update independently while application stacks pick up current values. What should they do?

Accepted Answer

Have the networking stack write the VPC ID and subnet IDs to SSM Parameter Store parameters, and have application stacks read those parameters at deploy time (e.g., via CDK StringParameter.valueFromLookup or CloudFormation SSM dynamic references).

Answer

Convert the networking stack into a nested stack of each application stack so the resources are recreated per application and no cross-stack dependency exists.

Answer

Add a DeletionPolicy of Retain to the exported outputs so CloudFormation permits updates to the exported values while consumers keep the old references.

Answer

Enable termination protection on the networking stack and manually copy the subnet IDs into each application stack's parameters whenever they change.

Question 16

A DevOps team manages a production CloudFormation stack containing a shared VPC, transit gateway attachments, and a KMS key used by multiple downstream stacks. During a recent incident, an engineer ran `aws cloudformation delete-stack` against the wrong stack name from a scripting error, and the deletion began before it was cancelled. The team wants to guarantee that no accidental or automated API call can delete this foundational stack, while still allowing normal stack UPDATE operations to proceed through their CI/CD pipeline. What should they implement?

Accepted Answer

Enable termination protection on the stack so delete-stack calls are rejected until protection is explicitly disabled.

Answer

Enable termination protection on the stack, and set DeletionPolicy: Retain on the resources inside the stack.

Answer

Apply a stack policy that denies the Update:Delete action on all resources in the stack.

Answer

Attach an IAM policy to all pipeline roles that denies cloudformation:DeleteStack on every stack in the account.

Question 17

A DevOps team manages a production CloudFormation stack that includes an Amazon RDS DB instance and several Lambda functions. Recent template updates have occasionally caused unexpected resource replacements, resulting in unplanned downtime. The team wants a process that lets them see exactly which resources will be added, modified, or replaced before any changes are applied, and requires an explicit approval step before execution. Which approach BEST meets these requirements?

Accepted Answer

Create a CloudFormation change set from the updated template, review the proposed actions (including the Replacement column), and execute the change set only after approval.

Answer

Enable termination protection on the stack and run update-stack directly, relying on the rollback-on-failure behavior to undo any unwanted replacements.

Answer

Run CloudFormation drift detection before each update-stack call to identify which resources will be replaced by the deployment.

Answer

Add a DeletionPolicy of Retain to all resources so that any replacement preserves the original resource instead of causing downtime.

Question 18

A DevOps team manages a networking CloudFormation stack that uses the Outputs section with the Export field to publish a VPC ID and subnet IDs. Several application stacks consume these values using Fn::ImportValue. During a planned refactor, the team attempts to update the networking stack to remove one of the exported subnet outputs, but the stack update fails. What is the reason for the failure, and how should the team proceed?

Accepted Answer

CloudFormation blocks removal or modification of an exported output while another stack imports it; the team must first update the consuming stacks to stop importing the value, then update the networking stack.

Answer

Exported outputs can only be changed by enabling termination protection on the networking stack first; the team should enable it and retry the update.

Answer

The update failed because exports are region-scoped; the team should recreate the export in every region before removing it from the networking stack.

Answer

CloudFormation requires a stack policy allowing 'Update:Delete' on the Outputs resource; the team should add the policy and rerun the update.

Question 19

A DevOps team manages a production application using a single CloudFormation stack that provisions an Amazon RDS database, an S3 bucket containing user uploads, and several stateless compute resources. During a planned refactor, the team must remove the compute resources by deleting and recreating the stack under a new name, but they cannot afford to lose the RDS data or the S3 objects. They also want CloudFormation to leave the existing database and bucket in place — without creating final snapshots that incur extra cost — when the old stack is deleted. Which approach ensures the stateful resources survive the stack deletion with the least operational risk?

Accepted Answer

Add a DeletionPolicy of Retain to the RDS and S3 resources in the template, update the stack to apply it, then delete the old stack.

Answer

Add a DeletionPolicy of Snapshot to both the RDS instance and the S3 bucket, then delete the old stack so recoverable copies remain.

Answer

Enable termination protection on the stack, then delete the stack and confirm that stateful resources are automatically preserved.

Answer

Manually export the RDS data and copy the S3 objects to another bucket before deleting the stack, then re-import them after recreation.

Question 20

A DevOps team manages an RDS instance using CloudFormation. Company policy prohibits storing database passwords in template parameters, plaintext, or version control. The password is already stored in AWS Secrets Manager under the secret name 'prod/rds/master'. The team wants CloudFormation to inject the password into the RDS instance's MasterUserPassword property at deploy time without ever exposing the value in the template, change set, or stack events. Which approach meets these requirements?

Accepted Answer

Use a dynamic reference in the MasterUserPassword property with the syntax '{{resolve:secretsmanager:prod/rds/master:SecretString:password}}'.

Answer

Add a NoEcho parameter for the password and pass the Secrets Manager value into it via the deployment pipeline at stack creation.

Answer

Reference the secret using an SSM dynamic reference '{{resolve:ssm-secure:prod/rds/master}}' so the value stays encrypted.

Answer

Use a Lambda-backed custom resource that calls GetSecretValue and returns the password as a resource attribute for MasterUserPassword.

Question 21

A platform team maintains a large CloudFormation template that provisions VPC, security, database, and application resources. The single template has grown past 500 resources and repeatedly hits the per-stack resource limit and exceeds the template body size limit during deployment. The team wants to break the template into logically separated components that are still deployed and updated together as one atomic unit, while allowing values (such as subnet IDs and security group IDs) to flow between the components without relying on cross-stack Exports that would block future refactoring. Which approach best meets these requirements?

Accepted Answer

Refactor the template into nested stacks using AWS::CloudFormation::Stack resources in a root stack, passing values between child stacks via the root stack's parameters and the children's Outputs.

Answer

Split the template into fully independent stacks and use CloudFormation cross-stack references with Export/Fn::ImportValue to share subnet and security group IDs between them.

Answer

Convert the template to a CloudFormation StackSet and deploy each logical component as a separate stack instance across the same account and region.

Answer

Keep a single template but move most resource definitions into an AWS::Include transform macro stored in S3 to bypass the template body size limit.

Question 22

A DevOps team manages a large application using CloudFormation. They currently use a single monolithic template that provisions a VPC, an RDS database, and an ECS service. The networking team wants to update VPC subnets independently without risking the RDS or ECS resources, while the application team wants to deploy ECS changes frequently. The team decides to split the monolith. They want the VPC to be reusable by multiple unrelated application stacks that are deployed and updated on separate lifecycles, and they must avoid a situation where updating the VPC forces an update or replacement evaluation of the application stacks. Which approach best meets these requirements?

Accepted Answer

Split the resources into separate root stacks and share the VPC outputs using cross-stack references (Export/ImportValue), so each stack has an independent deployment lifecycle.

Answer

Convert the template into a parent stack with nested stacks for VPC, RDS, and ECS, passing values between them as nested stack parameters.

Answer

Keep a single template but add Conditions and separate change sets so each team executes only its portion of the stack.

Answer

Use a single StackSet that deploys the VPC, RDS, and ECS as three stack instances into the same account and region.

Question 23

A DevOps team manages a production CloudFormation stack that contains an RDS database, an EC2 Auto Scaling group, and several application resources. During routine template updates, engineers have accidentally triggered replacement of the RDS instance twice, causing outages. The team wants a mechanism that blocks updates to the database resource specifically while still allowing the rest of the stack to be updated freely through the normal pipeline, without relying on engineers remembering to add flags at deploy time. Which approach BEST satisfies this requirement?

Accepted Answer

Apply a stack policy to the stack that denies Update:Replace and Update:Delete actions on the RDS resource's logical ID while allowing all update actions on other resources.

Answer

Add a DeletionPolicy of Retain to the RDS resource in the template so the database is never replaced during updates.

Answer

Enable termination protection on the stack so that no resources can be replaced during an update operation.

Answer

Move the RDS resource into a nested stack and set the nested stack's UpdateReplacePolicy to Retain so the parent stack cannot modify it.

Question 24

A platform team deploys a baseline security stack to 200 accounts using a service-managed CloudFormation StackSet targeting the entire organization. Recently, a bad template change caused the stack operation to succeed in the first several accounts before an IAM misconfiguration was noticed, requiring a painful manual cleanup across dozens of accounts. The team wants a way to automatically halt the StackSet operation early — before it reaches most accounts — if deployments start failing, while still allowing a small number of transient failures. Which configuration change should they make?

Accepted Answer

Set a low FailureTolerancePercentage (or FailureToleranceCount) combined with a low MaxConcurrentPercentage so the operation stops rolling out after only a few account failures.

Answer

Enable drift detection on the StackSet before every deployment so failing accounts are detected and skipped automatically.

Answer

Switch the StackSet permission model from service-managed to self-managed so each account validates the template with its own IAM role.

Answer

Add a stack policy to each stack instance that denies updates to IAM resources during the operation.

Question 25

A company manages infrastructure across an AWS Organization with 200 accounts. The cloud platform team, which does not have access to the Organization management account, needs to deploy and manage service-managed CloudFormation StackSets that automatically deploy to new accounts as they join specific OUs. The security team requires that the management account not be used for day-to-day StackSet operations. How should the platform team be enabled to perform these StackSet operations?

Accepted Answer

Register the platform team's member account as a delegated administrator for CloudFormation StackSets in the Organization, then create service-managed StackSets from that account with automatic deployment enabled.

Answer

Grant the platform team an IAM role in the management account with AWSCloudFormationStackSetAdministrator permissions and have them assume it for each deployment.

Answer

Use self-managed StackSets and manually create the AWSCloudFormationStackSetExecutionRole in every current and future member account via a bootstrap script.

Answer

Create the StackSets in the management account with service-managed permissions and share them to the platform account using AWS Resource Access Manager (RAM).